package com.ahdms.es.engine;

import com.ahdms.es.bean.enums.VerifyCertCode;
import com.ahdms.es.config.PropertiesConfig;
import com.ahdms.es.exceptions.VerifyCertException;
import com.ahdms.es.util.IKICertUtils;
import com.ahdms.es.util.LdapUtils;
import com.ahdms.es.util.OCSPUtils;
import org.bouncycastle.asn1.x509.Certificate;

import java.util.Date;

/**
 * IKI可信标识验证
 * @author qinxiang
 * @date 2021-04-09 9:34
 */
public class IKICertVerifyEngine extends X509CertVerifyEngine {

    @Override
    public boolean verifyCertTrustChain(Certificate cert) {
        return IKICertUtils.validateCertSign(cert, PropertiesConfig.getPkmCert());
    }

    @Override
    public boolean verifyCertIsRevoke(Certificate cert) {
        if(!PropertiesConfig.isCrlEnable()){
            return true;
        }
        Date date = LdapUtils.queryLdapByIki(cert, PropertiesConfig.getPkmCert());
        return date == null;
    }

    @Override
    public boolean verifyCertByOcsp(Certificate cert) {
        if(!PropertiesConfig.isOcspEnable()){
            return true;
        }
        Integer integer = OCSPUtils.verifyCert(cert, PropertiesConfig.getPkmCert(), PropertiesConfig.getOcspUrl());
        if(integer != 0){
            return false;
        }
        return true;
    }
}
